Inside Canary Mission: Secret BlackNest site scans, tracks activists
A network of unlisted websites tied to the pro-"Israel" doxxing group Canary Missionreveals a sprawling, professionalized operation that includes anonymous contributors, international tech vendors, marketing strategies, and a secret internal platform known as BlackNest. According to materials uncovered by Drop Site, BlackNest tracks firings, arrests, and deportations as measurable “company impact” metrics, outcomes the group openly celebrates.
BlackNest is one of several unlisted websites and content management systems used by Canary Mission, whose doxxing campaign operates out of "Israel" and has reportedly been leveraged by senior levels of the Trump administration. The information contained across these hidden platforms, ranging from names of staff and contractors to internal meeting notes, quarterly plans, and strategic documents, offers a rare look at how the operation has expanded and evolved.
The group’s non-public sites outline plans to broaden its efforts to punish Americans for pro-Palestine speech through doxxing and pressure campaigns, with arrests and deportations increasingly carried out by allies inside the State Department.
Defining ‘Impact’: Deportations, firings, and denials of entry
Web development material tied to BlackNest sheds light on how Canary Mission defines success. The platform categorizes outcomes under labels such as “change of behavior,” job loss, denial of entry to the United States, arrests, and “deportation/forced to flee.” The site also compiles media mentions, largely from US outlets, and highlights coverage that references Canary Mission’s influence.
Drop Site News previously reported on how donations flow to the group, but details about its staff, internal structure, and technical operations remained largely opaque due to Canary Mission’s secrecy. That changed after Drop Site obtained more than 100 gigabytes of data accessed through the backend of Canary Mission’s website, uncovering multiple live but intentionally hidden sites.
How BlackNest was discovered
A team of software engineers collected and archived BlackNest’s daily updates over three months last year, capturing data in May, June, and July. When archived, the site was being actively updated with an infographic tracking “news, articles, and impacts.”
BlackNest was hosted on an intranet URL called Kaloustropous, a Greek term that roughly translates to “good manners". Engineers spotted the URL through web development tools embedded in Canary Mission’s public submission form. From there, they identified numerous unlisted subdomains containing gigabytes of internal material, including screenshots used to profile targets and the BlackNest intranet itself.
Much of the content carries a corporate tone, portraying a hierarchical and highly organized operation. A “Team Overview” page credits a staff member named “Cheri” with identifying “the activist from” a viral video, while “Nora” is praised for completing “the Stanford Arrest Profiles.”
Messaging, campaigns, and political targets
A “Team Updates” section includes a “Branding Update” instructing staff to add a specific tagline to posts about New York City mayor-elect Zohran Mamdani: “A vote for Mamdani is a vote for chaos in NYC.”
Canary Mission added multiple students to its site following their arrests during pro-Palestine protests at Stanford University in 2024, and the Mamdani tagline appeared in emails and Instagram posts circulated by the group in June.
Another recorded achievement states: “Senator John Fetterman received our Philly report from multiple sources.” A campaign timeline references future targets, including MIT, the University of New Mexico, and “Harvard (Major Campaign).” The “Philly report” appears to correspond to a Canary Mission publication titled Philadelphia’s Network of Hate, released in June 2025.
BlackNest also catalogs news coverage tied to Canary Mission’s activities, including deportations and cases in which individuals left the US following arrests after US President Donald Trump took office. When NBC reported that the Department of Homeland Security testified in court that it relied on Canary Mission to identify deportation targets in July, BlackNest uploaded a PDF of the article to its “Impacts” section.
Inside day-to-day operations
Internal data offer clues about Canary Mission’s daily workflow. Time stamps on uploaded documents align with occupied Palestine time zones. A July calendar page shows a structured schedule, including marketing meetings led by “Phil” and “Amanda,” and a midweek “Popcorn Hour” focused on content strategy.
A page titled “Content Strategy Team” lists five active campaigns: MIT, Harvard, Dartmouth, Stanford Arrests, and “Indigenous Rights/PYM,” the latter marked as “not in production.” The site contains dedicated sections for those universities and for the Palestinian Youth Movement (PYM).
The content operation is divided into four subteams: profiles, editorial, reports, and social media. The social media team was assigned a key performance indicator of five posts per day, with a focus on Iran and Mamdani.
‘Company impact’ as a performance metric
Within BlackNest’s “Impact” section, the group openly frames its influence as “company impacts” meant to “track external influence.” In June, a snippet from The Nation was labeled “High Impact” and tagged under “self-deportation". The excerpt came from a May editorial by Abdelrahman ElGendy, an Egyptian writer who fled political imprisonment in Egypt and later decided to leave the US after the arrest of Mahmoud Khalil, knowing he was also listed on Canary Mission’s site.
Other impact categories include one labeled “ICE", and another devoted to the British rap duo Bob Vylan, who were targeted by Canary Mission and other pro-"Israel" figures after chanting “Death to the IDF” at a concert.
A landing page explains that the “Company Impact” section exists to “Track external company impacts, stakeholder feedback, and measure our influence across different initiatives and campaigns.” It remains unclear whether “stakeholders” refers to donors or other entities.
Anonymous Doxxers and false identities
The intranet also hosts uploads of social media profiles and personal data belonging to Canary Mission’s targets, offering insight into the group’s staffing levels. Most contributors operate under pseudonyms such as “Ned Flanders” and “Halle Comet".
One doxxer’s profile corresponds to a man named Alex Carson, whose name appears in business filings linked to Megamot Shalom, the Israeli nonprofit long reported to run Canary Mission. An “Alex Ben Carson” is listed in Megamot Shalom records as a content writer earning roughly $80,000 in 2022. He appears to be a UK-born pro-"Israel" writer who moved to "Israel" in 2008. He did not respond to inquiries from Drop Site.
More than 30 distinct doxxers appear to have created fake Facebook and other social media accounts to monitor, screenshot, and archive information on pro-Palestine students and activists. These accounts often present as Americans of different ethnic backgrounds and are connected to one another, with material uploaded using largely anonymous email addresses.
Strategic plans and long-term goals
Data accessed by Drop Site also exposes Canary Mission’s forward planning. A 21-page strategic document briefly appeared on BlackNest in July before being removed. The PDF outlines the group’s mission, values, targets, and a 2025 plan that includes sharing data with donors.
The document lists the group’s core values as: daas torah, integrity, passion for the cause, anonymity, being a “no-ego team player,” and rosh gadol, Hebrew slang for “seeing the big picture.”
Its stated purpose is to “fight those who hate the Jewish people,” while defining its niche as “dismantle the anti-Israel network by attacking the messenger, not the message.”
From 2021 to 2024, the group identified its primary targets as the “core 7: AMP, SJP, INN, JVP, CAIR, WOL, FJP,” referring to prominent pro-Palestine student groups and nonprofits.
The document also details donor engagement through Zoom meetings, webinars, and email communication. Donations remain largely opaque, routed through a US nonprofit to an Israeli counterpart.
Tools, technology, and scale
Bullet points in the strategy outline describe anonymity as “a tool to scare the enemy,” a “bottom-up approach” using individuals to dismantle organizations, and the claim, “We change the behavior of the enemy.”
The 2024 plan references the use of facial recognition software combined with data scraping to identify “named POIs", or persons of interest, alongside a security audit. For 2025, goals included differentiating the Canary Mission brand from competitors and sharing data with donors. One performance benchmark was the creation of 150 new profiles per week.
Abandoned spinoffs and tech partners
The data also suggest Canary Mission began developing a spinoff Chrome extension and website called the Museum of Online Antisemitism, which now appears abandoned. The project was designed as a private archiving tool, described internally as a kind of Wayback Machine for alleged antisemitism.
Screenshots show staff using the extension, and developer usernames in the code match those found in Canary Mission’s backend. The extension included features to obscure the identities of doxxers and improve the archiving of dynamic social media content.
An “About” page for the extension reads: “The Museum of Online Antisemitism (MOA) is a state-of-the-art, fast, and reliable archiving platform specifically for the pro-Israel and Jewish world to preserve the evidence of antisemitism.”
One Israeli tech firm appears to have worked on both MOA and Canary Mission’s infrastructure. Shefing, a boutique software consultancy based in a WeWork in occupied al-Quds and owned by French-Israeli entrepreneur Philippe Cohen, maintains GitHub repositories containing custom software used across both projects.